🔬 physics

QKD-XGuard: Physics-Informed Conformal Open-Set Monitoring for Unseen and Adaptive Attacks in Decoy-State BB84

QKD-XGuard is a simulation-validated monitoring framework for decoy-state BB84 quantum key distribution that integrates physics-informed residuals with conformal open-set learning to effectively distinguish legitimate channel drift from both known and unseen adaptive attacks, significantly outperforming raw-telemetry approaches in robustness and coverage.

Original authors: Wail Zita

Published 2026-09-21

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Wail Zita

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Quantum key distribution is a method for creating secret codes that relies on the fundamental laws of physics rather than the difficulty of solving complex math problems. In this system, information is sent as individual particles of light, usually through fiber-optic cables. Because the act of measuring these particles inevitably changes them, any attempt by an eavesdropper to listen in leaves a detectable trace. This makes the technology theoretically unbreakable. However, the real-world devices that send and receive these light particles are not perfect. They have imperfections, they drift over time, and they can be tricked by clever attacks that exploit the gap between the ideal theory and the messy hardware. The challenge for engineers is to tell the difference between a harmless glitch caused by a long cable or a warm day, and a malicious signal designed to steal the secret key.

To solve this, a researcher at Istanbul Medipol University has developed a new monitoring system called QKD-XGuard. This system acts as a sophisticated watchdog for quantum communication networks, designed to spot attacks that have never been seen before. Traditional security tools often work like a closed list of known criminals; if a new type of thief appears, the system might fail to recognize them or, worse, mistake them for someone else. QKD-XGuard takes a different approach. Instead of just looking at the raw numbers coming from the detectors, it first calculates what the numbers should be based on the laws of physics and the current state of the connection. It then focuses entirely on the difference between what was expected and what actually happened. This difference, or "residual," is the key. By ignoring the predictable changes caused by distance or temperature and focusing only on the unexplained deviations, the system can identify strange behavior even if it has never encountered that specific attack before.

The researcher tested this idea using a highly detailed computer simulation that mimics a real fiber-optic network. The simulation generated thousands of hours of data representing normal operation and four distinct families of known attacks. To make the test rigorous, the system was trained on three of these attack families but was never shown the fourth. When the fourth family was introduced, the system had to decide whether it was a known threat, a new unknown threat, or just normal noise. The results were striking. The system successfully identified the unseen attacks with high accuracy, correctly flagging them as suspicious with an AUC of 0.88. It also maintained a very low rate of false alarms, correctly identifying normal operation with an AUC of 0.91. This performance held up even when the researchers tested the system on a completely different set of conditions, simulating a much longer cable link that the system had never seen during its training.

A crucial part of the study was comparing this new physics-based method against older approaches that simply looked at the raw data without any physical context. When the researchers tested the system on the long-distance cable simulation, the old method failed, with its accuracy dropping significantly. It struggled because it had memorized the specific signal strengths of the short cables it was trained on and could not adapt to the weaker signals of the long cables. In contrast, the physics-informed system remained stable. Because it constantly recalculated what the signal should look like for the current distance, it could see through the change in cable length and still spot the subtle signs of an attack. This suggests that understanding the underlying physical rules is far more effective than just memorizing patterns in the data.

The study also tested the system against a particularly tricky, adaptive attack designed to be stealthy. This attack tried to hide by making very small, distributed changes to the signal rather than one big, obvious disturbance. The system caught this stealthy behavior in about 69 percent of the trials. While this is a strong result, the researcher is careful to note that it is not a perfect solution. The system did not catch every single instance of this adaptive attack, proving that no single tool can guarantee the detection of every possible future threat. The work is also a simulation, meaning it was run on a computer model rather than on physical hardware in a lab. While the model was built to be realistic and reproducible, the researcher acknowledges that real-world devices might behave in ways the simulation did not capture.

Ultimately, this research offers a practical step forward in securing quantum networks. It demonstrates that by combining machine learning with the hard constraints of physics, it is possible to build a security monitor that is robust against unknown attacks and adaptable to changing network conditions. The system does not replace the mathematical proofs that guarantee the security of the quantum protocol itself; instead, it acts as an operational layer that watches for anything that falls outside the safe, expected envelope of the system. By learning to distinguish between the natural drift of a machine and the deliberate manipulation of an attacker, QKD-XGuard provides a clearer, more reliable way to protect the secrets of the future.

Technical Summary: QKD-XGuard

Problem Statement
Practical Quantum Key Distribution (QKD) security relies on the assumption that the physical implementation remains compatible with the theoretical model used for security proofs. Current monitoring methods face two primary limitations:

Scalar Thresholds: Monitoring only the Quantum Bit Error Rate (QBER) is insufficient to distinguish between legitimate channel drift (e.g., temperature-induced loss) and sophisticated implementation-level attacks.
Closed-Set Assumption: Conventional supervised machine learning classifiers assume that all test-time attack families were represented during training. In an operational environment, a detector must handle open-set scenarios where an unknown attack family ( $A_{unknown}$ ) appears alongside known attacks ( $A_{train}$ ) and normal operation ( $N$ ). A closed-set classifier forces an unfamiliar pattern into the nearest known class, potentially masking a novel threat.

Methodology
The paper proposes QKD-XGuard, a simulation-validated monitoring framework for decoy-state BB84 QKD that integrates physics-informed modeling with conformal open-set recognition. The methodology consists of four coupled mechanisms:

Physics-Informed Residual Representation:
Instead of feeding raw telemetry (gains, error rates, detector clicks) directly into a neural network, the system first calculates the deviation between measured values and values predicted by a decoy-state physical channel model.
- The model estimates expected gains ( $Q_x$ ), error rates ( $E_x$ ), single-photon yields ( $Y_1$ ), and key rates based on current operating parameters (fiber length, attenuation, detector efficiency).
- The input to the learner is the standardized residual: $z_{t,j} = (m_{t,j} - \hat{m}_{t,j}) / \hat{\sigma}_j$ . This allows the system to distinguish between legitimate changes in channel regime (e.g., distance) and malicious deviations.
Temporal Feature Encoding:
For a sliding window of 16 telemetry blocks, the system computes five temporal summaries (mean, standard deviation, linear slope, max absolute value, lag-1 autocorrelation) for each of the nine residual channels, resulting in a 45-dimensional feature vector.
Latent Metric Learning:
A compact multilayer network ( $45 \to 64 \to 32 \to 16$ ) maps the residual vector to a 16-dimensional latent space. The training objective minimizes cross-entropy while applying a metric regularizer to contract same-class samples toward batch centroids and penalize insufficient separation between classes.
Class-Conditional Conformal Prediction & Open-Set Rejection:
- Conformal Calibration: For each known class, a nonconformity score (Mahalanobis distance) is calculated. A conformal p-value is derived using a held-out calibration set to ensure a nominal 90% coverage for known classes.
- Decision Rule: An observation is classified as "unknown" if:
  - The conformal prediction set is empty (no known class meets the significance threshold $\alpha_c = 0.10$ ), OR
  - The minimum distance to any class prototype exceeds a calibrated threshold ( $\tau_{ood}$ , the 99th percentile of calibration distances).

Key Contributions

Physics-Residual Representation: A novel input formulation that factors out predictable channel variations, forcing the model to learn deviations from physical expectations rather than absolute signal levels.
Open-Set Protocol: A "leave-one-attack-family-out" evaluation strategy where an entire attack family is excluded from training, calibration, and threshold selection, rigorously testing the system's ability to reject unseen threats.
Disjoint Regime Testing: Evaluation on a fiber length regime (75–115 km) completely disjoint from the training regime (10–65 km) to verify that the detector relies on physical inconsistency rather than memorized attenuation ranges.
Reproducibility: The study utilizes a reproducible stochastic block-level simulator with all results generated by an accompanying Python script, covering 3,500 development sessions and various attack families.

Results
The system was evaluated across four leave-one-family-out folds and a disjoint channel regime:

Known-Class Performance: Achieved a macro-F1 of $0.952 \pm 0.007$ with empirical class-conditional conformal coverage of $0.910 \pm 0.013$ (targeting 90%).
Unknown-Attack Detection: Achieved an AUROC of $0.945 \pm 0.049$ and an unknown recall of $0.876 \pm 0.137$ for unseen attack families. Performance varied by attack type; "Intercept-resend" and "Time-shift" were detected more reliably than "PNS-like" behavior.
Robustness to Distribution Shift: In the disjoint 75–115 km regime, the physics-residual model maintained a macro-F1 of $0.962 \pm 0.004$ . In contrast, an ablation using raw telemetry (without physics residuals) dropped significantly to $0.796 \pm 0.068$ .
Adaptive Stress Test: A deliberately stealthy, adaptive composite attack was rejected in $69.2\% \pm 5.7\%$ of sessions, indicating that while effective, the system does not guarantee detection of all low-amplitude, distributed manipulations.
Baseline Comparison: QKD-XGuard significantly outperformed baselines including Isolation Forest, One-class SVM, and a scalar maximum-QBER threshold, which failed to detect the stealthy adaptive attacks.

Significance and Claims
The paper positions QKD-XGuard as an operational monitoring layer rather than a replacement for composable QKD security proofs or finite-key analysis.

Core Claim: Physics-residual modeling is a robust mechanism for separating legitimate channel variation from unsupported attack behavior, particularly when the system operates outside its training distance regime.
Limitations Acknowledged: The author explicitly states that an "unknown" label indicates a lack of model support, not definitive proof of a cyberattack (it could be hardware faults or model mismatch). The study is simulation-based; external validity requires hardware-in-the-loop testing.
Modest Scope: The work does not claim universal "zero-day" detection. It demonstrates that open-set performance varies materially by attack family and that while the method improves robustness against distribution shifts, a fraction of adaptive, low-amplitude attacks may still fall within the calibrated support of known classes.

Technical Summary: QKD-XGuard

More like this